Backup files left public: Crawl Audit check 167

Short answer: a backup left in your website's public folder can be downloaded by anyone who guesses its name. Copies of code files, database dumps and site archives can reveal passwords and how your site works. Check 167 tests for one common backup filename in the full audit.

What Crawl Audit checks

• It runs only in the full audit, and only when the site owner has agreed to it. The free check shows that it runs in the full report.
• It requests /backup.zip.
• Fail: the file loads (a 200 or 300-range response).
• Pass: it doesn't.

That's a single filename. A pass doesn't rule out site.tar.gz, db.sql or index.php.bak, so look in your web root yourself. A site that answers every address with a page (rather than a 404) can also fail here by mistake; open the address to confirm.

What OWASP says

• "While most of the files within a web server are directly handled by the server itself, it isn't uncommon to find unreferenced or forgotten files that can be used to obtain important information about the infrastructure or the credentials."
• "For example, if we make a copy of login.asp named login.asp.old, we are allowing users to download the source code of login.asp." The server runs .asp files but serves .old files as plain text.

Fixing it

• Keep backups outside the public folder, or off the server entirely.
• Don't edit live files by making copies like .old or .bak next to them.
• Block common backup extensions at the server as a safety net.
• If a backup was public, treat every password inside it as exposed and change them.

On devmarde.com

/backup.zip returned a 404 on our site on 6 October. It passes.

Sources

• OWASP Web Security Testing Guide, Review old backup and unreferenced files (WSTG-CONF-04, v4.2), checked 6 October 2026.